Technical Architecture Review

[seamustuohy]

The proposed architecture should be sent out to a set of communities to get review before major technical work begins. This will help us streamline the development process and learn from problems faced by other groups.

[seamustuohy]

Using a wiki page to store current technical architecture.

[seamustuohy]

Added some data flow diagrams and explanatory language around how the censorship and configuration systems will work. https://github.com/OpenInternet/co-pilot/wiki/Technical-Architecture

[seamustuohy]

Survey considerations for Technical Architecture:

Initial Tools that should be targeted for support:

• Tor Browser Bundle
• VPN's
• Orbot
• Proxies

What tools would benefit the most from an environment like this?

What tools do you do hands on training on?

Technical Feature Requests

• I'd love it if there was a DNS redirection feature. This is something so fundamental to the Internet that we don't normally pay attention to it.
• Just https blocking/throttling would be great.
• A dummy Google.com or Yahoo.com page with a self-signed certificate -- as part of that DNS redirection feature. This would show trainers how people react when they get warnings in their browser.
• Brute forcing passwords or showing how a phishing attack would work.
• I'd like to be able to demonstrate cybersecurity vulnerabilities, not cybercensorship.
• I'd like to be able to send my trainees a spear-phishing e-mail with an attachment which successfully infects them because their software's not patched.
• self-signed certificate -- as part of that DNS redirection feature. This would show trainers how people react when they get warnings in their browser.
• Content/keyword-based blocking

Technical considerations

• It needs to be created in a form that doesn't allow the tool to be downloaded and used nefariously. Like, let's not inspire trainers who are also parents to start censoring their kids' internet use

[seamustuohy]

Functions of common tools targeted for initial technological support:

Protect against local traffic analysis

• "Using Tor protects you against a common form of Internet surveillance known as "traffic analysis." Traffic analysis can be used to infer who is talking to whom over a public network. "¹
• Anonymous web proxies are "intended" to anonymize the web-traffic from the proxy user to everyone but the proxy owner.
• VPN's provide a secure link for all traffic to be tunneled to the VPN server before being sent to it's intended destination.

Bypassing filters and censorship

• Proxies, Tor, and VPN's are commonly used to bypass "blacklists" put in place by local censors by redirecting that traffic to a non-blacklisted user.
  1. Why we need tor.

Environments Required to address these needs

Per Survey

What topics would benefit the most from an environment like this?

type	Number of Votes	Percent of Votes
URL based blocking / throttling	12	71%
DNS based blocking / throttling	12	71%
HTTPS based blocking / throttling	11	65%
HTTPS Certificate Spoofing	12	71%
DNS redirection	12	71%
Application based blocking / throttling	10	59%
Other	2	12%

Based Upon primary supported tools

• URL based blocking / throttling
• DNS based blocking / throttling
• HTTPS based blocking / throttling
• DNS redirection
• Application based blocking / throttling

[seamustuohy]

Technical Architecture review has been completed. No major changes to the current technical architecture need to be made based upon feedback from multiple technologists in both networking and circumvention tech development. Technical review will continue in a more ad-hoc manner as features are added.